feat: add verified WebLLM browser runtime

[aantenore]

What changed

• add a dedicated optional WebLLM 0.2.84 adapter with lazy provider loading
• bind model selection to host configuration and stream OpenAI-shaped chunks through the fenced broker
• make initialization, cancellation, drain, disposal, and concurrent disposal fail-safe
• add a two-tab Chrome/WebGPU live lab and opt-in real-model Playwright gate
• prove the provider stays outside the core bundle and document the ownership boundary with WebLLM workers

Why

The first alpha proved multi-tab coordination only with deterministic simulation. This increment verifies that the provider-neutral seam can own an actual browser model once, serve a peer page, and preserve the existing fencing, admission, terminal, and privacy contracts.

Validation

• corepack pnpm check — 66 unit tests, coverage, lint, types, builds, publint, and package type checks
• corepack pnpm package:smoke
• corepack pnpm run audit — no known production vulnerabilities
• corepack pnpm test:browser — 12/12 scenarios across Chromium, Firefox, and WebKit
• real Chrome/WebGPU gate with WebLLM 0.2.84 and SmolLM2 360M — one owner, one peer, non-empty matching stream/result, positive usage, one terminal, zero console/page errors

Boundaries

WebLLM remains an exact optional peer and is imported only during elected-owner initialization. The core does not choose a model, absorb provider caching, or nest WebLLM's Service Worker topology.